1835193 - Socket and utility process sandbox policies allow stat()ing any file

Status: RESOLVED FIXED

(Core :: Security: Process Sandboxing, defect, P1)

Description

[Jed Davis [:jld] ⟨⏰|UTC-7⟩ ⟦he/him⟧]

While reviewing a patch, I noticed these existing lines of SandboxBrokerPolicyFactory.cpp where we use AddDir to grant MAY_ACCESS to everything under /, recursively. This won't allow opening files or directories, but it will allow calling stat on any file; I've verified this by injecting function calls with gdb.

The documented intent there was just to allow stating the / directory itself; i.e., it should have used AddPath. I think that part of the problem here (and the other patch I was looking at seemed to have a similar issue) is that the name AddDir sort of looks like it's for granting access to just a directory, and not the entire subtree. It might make sense to rename that to AddTree or something like that that's clearer about what it does, and rename the old AddTree (which dates back to when the policy was a hashtable of exact paths with no recursive rules or elaborate realpath logic, and was originally targeted at B2G where OS files were more static) to AddTreeStatic or something — or maybe even remove it, because it's currently unused and I'm having trouble thinking of a situation on desktop Linux where we'd want it.

That renaming could be done separately. Doing both changes in the same patch would help make the security bug less obvious, but I don't know if the severity of this bug is high enough to justify worrying about early disclosure like that.

Comment 1

[:gerard-majax]

Attachment: WIP: Bug 1835193 - Remove old AddTree

Comment 2

[:gerard-majax]

Attachment: WIP: Bug 1835193 - Remove old AddTree

Comment 3

[:gerard-majax]

Attachment: Bug 1835193 - Remove AddTree and rename AddDir to AddTree r?jld!

Comment 4

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/0341ac8af840
Remove AddTree and rename AddDir to AddTree r=jld

Comment 5

[Sebastian Hengst [:aryx] (needinfo me if it's about an intermittent or backout)]

https://hg.mozilla.org/mozilla-central/rev/0341ac8af840